Description
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `<data android:scheme="android_secret_code">` elements is rendered in HTML reports without sanitization, enabling session hijacking and account takeover. Version 4.4.5 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.4.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mobsf | < 4.4.5 | 4.4.5 | GHSA-8hf7-h89p-3pqj |